Can it be secure to have root/user accounts without password

[litan]

Hi,

whenever I installed machines, I followed the prevalent advice to use strong passwords for accounts,
especially the root account, since security is important to me. Now that I learned more about Linux/Gentoo,
I can’t shake the feeling that I simply waste my time typing some of these passwords again and again.
But before I remove my root passwords, I wanted to get some feedback if this is really safe.

Details:
I have a couple of virtual machines where I log in as root to do system administration and as normal user
to do normal user things. The host has strong passwords for all accounts and I lock the screen/log out on
consoles when necessary. On the VMs I would like to log into the console as root and different users
without the need to enter a password (how to accomplish this technically is not part of the question).
I want to leave them logged in on the consoles and only lock the host.
I use those VMs for production and they hold sensitive data, so security is paramount but I don’t necessarily
want to compromise usability for redundant layers of protection.
In case it is relevant, I do not use sudo and don’t want to change this if at all possible.
While it is not my use case, I believe it would be the same for a bare metal machine that nobody has physical access to.

As I understand, in order to not compromise security by not having passwords, I would have to do at least the following:
- make sure that on the VMs no user is in the group wheel (which should block any user switching)
- if OpenSSH ist used, forbid login via password:

[joanandk]

This question is the same as if one would ask us, do I have to lock my safe? I always lock my main door.

So to your question: No, it is not safe.

[Suicidal]

I would use ssh keys without passwords before not requiring passwords on accounts.
At least that way you are still requiring a key to unlock the door.

[Ant P.]

By removing the password you'll no longer be able to log in to those accounts without sudo or ssh keys. So yes, in effect it's more secure.

[litan]

[Ant P.]

[litan]

[litan]

I can think of 5 scenarios where the user password is asked for:

1) console login
2) su
3) ssh password authentication
4) sasl authentication via postfix/dovecot (possibly other server side mail software too)
5) sudo

Of those, I believe, only 1) applies per default, all others require deliberate action to be in effect.
For them to be of concern, I would have to at least do the following:

2) add users to wheel group
3) add sshd to default runlevel
4) install and configure postfix/dovecot with sasl authentication
5) install sudo

So my line of thought is:

1) if I physically make sure nobody has console access (by locking the screen of the password protected host machine - remember, we are talking about virtual machines here)
2) and don't add anybody to the wheel group
3) and make sure password authentication is disabled in OpenSSH
4) and don't install postfix/dovecot
5) and don't install sudo

then there should be no opportunity for an attacker to ever get access to an account.
(Be it by knowing the account password or by the account not having a password at all)
Thus this setup would be secure.

I am sure there are more software packages that would be a problem with paswordless users if installed and
not carefully configured.

Since I did not yet receive an explanation for any of my questions, I would like to ask again:
- Am I missing something or is this setup indeed bulletproof?
- What default or even common features/packages on a typical Gentoo installation would be of concern for passwordless user / root accounts?
- What extra packages can you think of that would be a problem?

If you believe this setup is not secure, please explain how an attack would look like.

[NeddySeagoon]

litan,

For remote systems, disable root logins entirely.
This forces attackers to log in as a user then use sudo or su to become root.
Its a bad thing to have a bot brute force you root password.

Lets look at what an attacker needs to get in. Its not a lot. A valid user name and the matching password.
Everyone has a root user, so that's 50% of the required information gifted to them.

Use key based logins for users. Its your call if you set a password on the ssh key.
The key never leaves your machine. ssh key based logins are challenge/response based.
If your system is physically secure, that may be good enough. If its a laptop that is not physically secured, you want a password on the key.

Consider storing the key in a hardware token, like a Yubikey. There are several others.

This is all well and good when everything works as intended. Security is like the layers of an onion.
The idea is not to keep determined well funded attackers out. Just to make it clear that you have given security some thought and that there are easier targets to attack.
It really is like this xkcd.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[litan]

Hi NeddySeagoon,

while your post is not directly related to my question, you brought up a point that I also find quite interesting:

[NeddySeagoon]

litan,

Anyone who has physical access to your system can image its RAM almost totally intact.

There are two methods.
1) Reboot a USB key an save a RAM image. RAM is not wiped on reboot, or even power off.
2) Remove the RAM while the system is powered up and image it elsewhere.

Even though its DRAM and the contents must be refreshed, the contents take much longer to decay than the refresh time.

Google knows of both these attacks. Worse, decrypted key recovery has been demonstrated following both of these attacks too.

It boils down to analysing your threat model, then deploying suitable defences.
Not forgetting the $5 wrench too.

I wasn't recommending Yubikey, As you say, there are other open examples.
They all have one flaw. They are trying to create write only memory and that's hard to do in a way that can be useful.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Ralphred]

Guys, you can go at this for days.

Unequivocally, security is always a trade-off against usability.
A password, by definition, is only security through obscurity.
If in your use case the machine is 100% physically secure, and there is no vector for remote attack that can utilise a password, the password is moot.

If ,however, there are more secure alternatives for you to access the machine (re: priv/pub key auth), that allow you the same level of usability, whilst at the same time allow the increasing of the inherent entropy of your "obscure" yet unused password, it would be irresponsible to not take advantage of this in a "production" environment involving "sensitive data".

[litan]

Neddy

[NeddySeagoon]

litan,

[litan]

[NeddySeagoon]

litan,

I don't know enough about how authentication operates on these programs to offer any useful commentary.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[litan]